Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Coop's Troops writes "An exploit writer at Core Security Technologies has discovered a serious vulnerability that exposes users of Microsoft's Virtual PC virtualization software to malicious hacker attacks. The vulnerability, which is unpatched, essentially allows an attacker to bypass several major security mitigations — DEP, SafeSEH and ASLR — to exploit the Windows operating system. As a result, some applications with bugs that are not exploitable when running in a not-virtualized operating system are rendered exploitable if running within a guest OS in Virtual PC."

That's what I'm wondering. Does randomized address still occur on VPC7's competitors? And if VPC is this way, then does Hyper-V thwart host address randomization, and so on? What's the difference in architecture that allows VPC to thwart this, and others go merrily on their way-- with whatever memory ring permitting the randomization of kernel access? Hmmmmm.

It's OK because you can't step out of the sandbox. If the guest OS running the DNS server gets compromised, the compromise code can't step out of its sandbox and attack the guest OS running the webserver, or reach into the guest OS running the Active Directory server and grab the password list.

An attack that can break out of a virtual machine is a much, much bigger problem than one that stays contained inside the VM. If a guest gets compromised, you restart it from a known-clean state. If the host gets c

You're still missing the point, the CRITICAL SERVICE running on the guest OS is now vulnerable to attack, including slow and subtle corruption of the data. If the critical service dies or the data is corrupted to unusable, it hardly matters if the host OS is still OK.

In other words, when all the gold comes up missing, how many people will be relieved to hear the vault isn't damaged?

Are you aware that the majority of security vendors employ such personnel? The most effective means of finding vulnerabilities like these is, oh I don't know, to attempt to exploit systems. Reference Internet Security Systems [iss.net] (now owned by IBM), several key members of which I used to have coffee with once or twice a week.

At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes? I know Linux and Mac have had their share of holes, but it seems as if every week there's a new announcement about some MS product that has either a 0 day flaw, or another MAJOR flaw? And even worse is their failure to deal with them in a reasonable amount of time! I mean 6 months to COMMENT on an advisory? That's ridiculous... Sure, they may have a lot of notices to work through, but if that's the case, hire more developers to deal with the security issues! They are out spreading the message that you can depend on MS products, and then leave gaping holes open for months... Not to long ago (within the month), they delayed a patch --well, wanted to anyway before they were called out on it-- for a 0-day in IE by 3 weeks, so that they could put it in a "planned update to IE"... If this was a popular open source project trying to pull this stuff, how quickly would a fork surface? Then again, it's all about placating the sheeple, right?

The moment they put out a patch that breaks anything, or makes things worse the uproar will be greater. Its also amazing how it will work find in say, the spanish version, but not on the chinese versions. So many things and so many different products.

I understand in programming there is always a possibility of a bug creeping up but common, Microsoft is one of the largest companies in the world, they have been working on the operating system for 20+ years now. They higher the worlds top PHD's to engineer the whole thing and pay them accordingly. Even the code monkeys are MIT grads with specialties in these core systems. When as a company you do one thing and get as much money as they do to do it there is an expectation of them and when you claim to be

Well, OS X has the luxury of knowing exactly what type of limited hardware set the system it will be running on is using, and not a lot of variety. Linux doesn't have to worry about breaking thousands of applications every time they update the core OS. Microsoft has neither of these luxuries. Microsoft is also king in the corporate desktop arena, and if a business application breaks, it will be far worse for them and the corporate application users compared to the way it currently is set up. And even with a

I've upgraded "linux" (OS, libs, and what not) literally thousand of times in the ca. 15 years I've been using it, and I doubt there were 5 times where I has a real problem with the many apps I use stopping working...

In the past 5 years of managing both production linux boxes and Windows boxes, I can honestly say I've seen more Windows updates break things than Linux updates break things. Typically, it's due to some rogue program that was either misusing an API, or relied on string results returned from a particular API call (rather than using the proper API, or a constant)... Who do I blame for that? I don't blame MS. I blame the offending software vendor. It's typical practice (that I follow) to wait on all non-c

MS has quite a lot of competing agendas:- keep backwards compatibility, v1. That means a bunch a old APIs, services, apps... Not only was security not much of a concern back when those were written, but any change in the environment risks unveiling new vulns. These pooor guys are actually supposed to maintain IE 6, IE7, and IE 8.- keep backwards compatibility, v2. MS can't really change the security model or the way they expose it without, again, breaking apps. Since NT, Windows's security model is not bad. But MS can't really implement it fully (no apps changing system-wide ressources, no writing outside of a handful of approved dirs...) without, again, breaking apps.- add features- maintain an incredibly wide array of software. MS = Oracle + Linux+ php + Apache + OOo + Firefox +...

So yes, I really hate the pain that managing MS systems is. I, and they, know they could make things better by breaking a lot of apps. They choose not to... prolly because their customers want them not to. I can understand that.

then with windows vista why didn't MSFT include an XP mode, than ran in it's own self contained section while using the higher security of a modern OS?

MSFT is trying to maintain compatibly with single user OS's in a networked world and failing miserably. Apple simply included a backwards compatibility mode and with every release slowly stopped installing.

And I told people at the time that I expected Microsoft to take _at_least_ 10 years to be able to do that consistently. 15 years wouldn't surprise me.

While I have not yet tried out Win7 or IE8 myself, everything that I've read says that they've made remarkable progress in improving their overall security stance. They just might finish up nearer the shorter end of my estimate than I thought at the time.:)

Don't forget, you're talking about a monolith of a company. They have more than enough resources to pour into security. Yet they don't... I refuse to cut them any slack, when open source projects which are powered by volunteers (I know not all are, but a significant number are) can produce (and do produce) results SIGNIFICANTLY faster than MS typically does... If a bunch of volunteers with VERY limited resources can do it, why can't a company with practically unlimited resources handle it?

Pouring resources into one particular project doesn't work. But pouring resources into a pile of otherwise unrelated projects does. IF it's a problem of overload (where they have 1000 outstanding issues to investigate/fix, and less than 1000 people to work on it, you could gain something by adding resources... The "Mythical Man Month" is about adding resources to one project (where everyone's work depends on everyone else's)...

It's not about fixing 1000 issues, if you tackle security like that, you'll be fixing 1000 issues every month until the end of time. And your problem will grow as your company and the amount of code you write grows. So theoretically you could eventually break even, but the worst security issues will be the ones you don't know about, the ones you can't measure in your tickets closed per month metric. So what if you closed 1000 bug tickets in a month? Anyone can do that, how about you go an entire month witho

Well, that's quite fair... Perhaps then it's time for MS to invest the resources needed to revamp their development process (Changing policy and workflow, perhaps firing some people and hiring others, etc). Either way, I think at least part of my OP is correct, in that they have the resources needed to change things to make it better. Yet they haven't (well, at least that the public has seen)...

Well then we'll have to agree to disagree. I think Vista was an important and painful step forward for security, and that Windows 7 is probably about as secure as Linux 2.6.x. (Nothing can stop a user from wanting to see the dancing bunnies, etc.)

In Linux for example, gksudo is not a secure way to enter your password, and neither is entering your password into a sudo prompt in a shell. In Windows, you'd need to have already exploited the computer in order to read a UAC prompt.

Just for clarification, I wasn't talking about that kind of security vulnerability. I'm talking about true zero days that require no unusual action on the part of the user. Such as the case of simply vising an infected site, or a remote exploit. For what you are talking about, I agree 100%...

I think it's important to remember that the vast majority of online linux boxes are going to be servers which are already locked down, being run by at least semi-competent admins and probably with almost all the ports blocked except 80, 443, 21, an SSH port, etc. Essentially, they have a very small surface area, and even if there was a zero day, it's very easy for you to say "ah, that's not Linux's fault, that's Apache's fault. Even running OpenBSD would not have saved them."

At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes?

Because many security flaws are in old software - which they aren't "pushing" any more. Today's flaw is a exception but requires a user that use XP mode in such a way that an attacker can get at it (say - if you're running an old insecure version of Firefox in XP mode) which, you have to be honest here, is not all that likely since XP mode will be more used for old games and business apps.

As for the the "0day flaw" you mentioned, if it was an Open Source project you'd likely been asked to update to IE8 i

I'm all for full disclosure, but at least give people a fighting chance to patch their systems.

I agree 110%. But I also want a patch in a reasonable amount of time (and that time is dependent on the risk). If it's a true 0-Day, I want the fix today. Not 3 months from now. I want it today (I know I won't get it today, but that doesn't mean it shouldn't be an ASAP thing)...

Which allows for large companies that depend on IE to do regression testing on one patch (or patch release cycle), instead of two or

The good news is that this doesn't affect the big iron (Hyper-V). However, for people who have Windows 7 and XP mode, using it for Web browsing, this will cause them a world of hurt.

Since this essentially doesn't affect servers, I'm going to recommend to people that they move to VMWare Workstation if they want commercial support, or VirtualBox if they desire an open source solution. Either one of these has as many features as VirtualPC (although VirtualPC has one nice advantage -- it drops changes to the undo disk fast compared to the 2-3 minutes VMWare does.)

A hole in a hypervisor is a really bad thing. A lot of people use VMs for honeypots, and this would cause unintended infections, or other damage, perhaps catastrophic.

Honeypots are designed to get hit. This bug doesn't make the host system vulnerable, it just means that the client OS is easier to exploit.

If it worked on Hyper-V, this would be a big problem; that's a server-level technology where even the clients are expected to remain secure. On the other hand, Virtual PC isn't even a hypervisor; it requires a full OS onderneath it, running itself as just another Windows app. Up until 2007 didn't even require hardware support for virtualization.

There was a bit of upset about that point when XP mode got reviewed. Since it's based on VPC and not Hyper-V, it shouldn't require x64 and AMD-V or Intel-VT, but for some reason, it does. A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode. Of course, that bullshit is actually Intel's fault, so I tend to cast a more glaring eye at them when I think about it.

I actually had a chance to talk with one of the guys behind Wirtual PC (including the one that powers Virtual XP Mode) a few months back. His answer was that when MS started work on the Windows Virtual PC (WVPC, the current version) 3 years ago (roughly when VPC2k7 shipped), they contacted Intel and AMD and asked if they were going to offer hardware virtualization on all models going forward. Both companies answered Yes, so to save development and testing costs, the (large block of tricky) code that enabled vitrualization on CPUs without hardware support was cut from WVPC. Skip forward a couple years to WVPC getting ready for release, and... still a lot of Intel CPUs without support for virtualization. At that point it was too late to add the feature without delaying shipping, so they didn't.

I asked whether they would add it in later, and he said they weren't planning to but might change their mainds if it became clear that this was a problem for enough of their customers. In the meantime, they were telling Intel to get its shit together the way it had said it would three years earlier, and he personally recommended going with AMD chips.

There was a bit of upset about that point when XP mode got reviewed. Since it's based on VPC and not Hyper-V, it shouldn't require x64 and AMD-V or Intel-VT, but for some reason, it does. A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode. Of course, that bullshit is actually Intel's fault, so I tend to cast a more glaring eye at them when I think about it

This is definitley a bug, but all it does is allow bypassing of security features in the virtualized system. In other words, you can exploit the VM client, but you still can't get at the host.

It's worth of a patch, but not of a panic. If you're virtualizing for security, you don't really care what happens to the virtual system (that's the point). If you're virtualizing so you can run an old OS, it's going to be full of holes anyhow. If you're virtualizing for any other reason, why the hell are you using consumer-grade virtualization software?

I mean, talk about small targets. I highly doubt that any hacker would find it worth his time to attempt to exploit this. I mean, first you have to find someone running XP mode. Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system) on the guest OS instead of the host OS. Then the person still has to have more than 2 gigs of RAM and be utilizing more than 2 gigs at once. Then, after all that, you only have access to the XP VM, which may or may not have anything of worth on it.

I mean, talk about small targets. I highly doubt that any hacker would find it worth his time to attempt to exploit this. I mean, first you have to find someone running XP mode. Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system) on the guest OS instead of the host OS. Then the person still has to have more than 2 gigs of RAM and be utilizing more than 2 gigs at once. Then, after all that, you only have access to the XP VM, which may or may not have anything of worth on it.

I'm not surprised that MS shrugged it off for now.

Sorry, nice try, but you don't seem to understand the issue here. You don't need to "get them to open an executable" - the point is that this vulnerability makes it possible to exploit existing vulnerabilities by bypassing mitigation techniques such as SafeSEH, DEP, and ASLR. It also has nothing to do with the amount of physical RAM on the system or how much is being used - the mentions of memory accesses refer to a process's virtual address space.

The target isn't that small. The fact that being virtualized breaks their security models is a big issue, and indicative of other big issues. (Using virtualization to break copy protection is one of my personal favorites.) And there are plenty of home and business users who have gotten Windows Vista machines foisted onto them who use and need to use Windows XP for software compatibility reasons, and who therefore run old games or critical applications in Windows XP under Virtual PC. I've done it myself for

To the extent we use it at work, it is for running stubborn old software that won't run in Windows 7 and/or 64-bit OSes. To date, we've discovered two applications like that. We also set them up to run seamless in the host OS (their window appears along any other window) where you don't see or play with the guest VM. It's easier for the user, and less potential trouble. They generally don't even know (or care) that the program is running in a VM.

So yes, it requires some fairly edge situations to exploit. Not many people use XP mode in the first place (most apps run natively in 7), if they do, reasonable bet they are just using it for compatibility for one or two old apps, not on a regular basis. So you have to convince them to get your exploit, and run it in their XP system. While I suppose you could craft it so that it doesn't run in 7, they may just say "Eh, do not want," and ignore it. If not they might wonder why a new app would have that problem. Either way you've got to get them to use it in XP mode and then... Well I guess you can own their XP VM. Wonderful, that does you a whole lot of nothing in general.

Also this isn't a case of "Bypasses any and all security," it just gets by some additional protections that can help in some cases. DEP, for example, doesn't do anything to stop malware, it doesn't check the "evil bit" and stop programs from running. All it does is prevent buffer overflows in some cases. You can't execute code in the data area of a program's memory. Ok, fine, however to even matter at all you have to have a program that is vulnerable to that kind of thing. If programs are checking their inputs and so on, then DEP never even comes in to play.

Don't get me wrong, I'm happy that MS has added some additional protections to make common problems harder to exploit, however they are not the first, last, and only line of defense. They are just things that cause additional problems for various sorts of exploits. Something has to find a way to try and get in to the system in the first place before they even matter.

I can't see this as any kind of big deal. I'm certainly not at all concerned with regards to the computers that use it at work.

No, you're misunderstanding the article. A "security mitigation" is something that stops exploits working without actually removing the hole that allows the exploit. Stuff like checking your stack is still intact before returning from a function in order to make stack overflow exploits fail: the stack can still be overflowed, but you can't (easily) exploit this any more.

This is really a vulnerability in any meaningful sense of the word. Rather, this means that certain advanced protections that Windows uses are less effective in a Virtual PC. Microsoft is actually in a leading postion when it comes to memory protection features as compared to anyone this side of OpenBSD.

What isn't someone issuing an "advisory" that the MacOS implementation of things like GS, ALSR, early-heap-termination and SafeSEH are either weak or nonexistent?

ASLR could use more entropy. Stack coookies could be present in every function, instead of just some. Every defense can be improved, and I don't think Microsoft has ever claimed that ASLR or GS is a reason NOT to produce a patch.

IMHO, Microsoft is completely correct to not issue a bulletin for this since that is an indication of a severe issue. And Core is free to make the issue known publically as well, and people can decide for themselves. But the Slashdot title is midleading at best.

The document and settings transfer wizard in Windows 7 did not ask me to authenticate for the other profiles I transferred. So I assume that if one were to examine that program there might be something in there.

When I installed Windows 7 on my laptop - at the point where it asked me for the Key I unplugged to take the laptop to my desk to get the key - and the Key dialog was simply bypassed! I was on the next screen. So I still haven't entered my key. Maybe th

Seriously, why is the parent modded funny? I switched to VirtualBox after MS bastardized Virtual PC for Win7, and haven't looked back. Admittedly, having all the media registered in a central database is annoying compared to the XML and path based approach of VirtualPC, but apart from that it's a solid product.

VirtualBox is great, only drawback is that some of it's features (USB for instance) have had BSODy issues in the past. I also recommend using VT/AMDV mode all the time when running XP in a VM, VirtualBox hardlocks the host after about a month running XP without VT on my system.

The central database for media is a little annoying but only until you get the media you usually use in it and then you can pretty much forget about it. Have actually come in handy sometimes when I need to figure out on what disk a

Elaborate, please? I've never had a hardlock with my VBox machines. You're saying that one month continuous uptime on the VM will do that? Do you have any idea why?

When VT is disabled my system will sometimes hardlock. This happens rarely so it's difficult to assert for certain if vbox was the guilty party but it only happened while vbox was running and was sometimes foreshadowed by vbox first crashing and the host following shortly.

Fortunately there's no reason not to activate VT unless you don't have it or run another VM that needs VT alongside vbox.

I know, I know. And yet, I'm not entirely convinced that it's better to have the apps you want/need while helping to send spam, and have your personal information sold to not just the highest bidder but to all bidders, running Windows, than it is to be secure on Linux, and be forced to make do with either no app, or simply a different app (not always worse) and have to learn something different.

It's a matter of priorities. Do I want to a) fight Windows security and have the apps I want, b) ignore security

It's a matter of priorities. Do I want to a) fight Windows security and have the apps I want, b) ignore security and have the apps I want, or c) have security, but have to learn some other app, or maybe do without that app.

The whole point of having a computer is to run the programs you want to run. If you're going to have to "do without", you might as well unplug the damn thing (thereby achieving perfect security).

That helps to emphasize what some of the developers are doing with ChromeOS and similar offerings.

More than half the people in the world who own computers do nothing but check email, play a few flash games, do some online shopping, and other similar frivolities. Most people don't need multi-Ghz CPU's, super Fps video cards, terrabytes of hard disk space, or more than a gig of memory. And, most people don't need all the utilities, games, services, etc that are found in any standard Windows installation.

A lot of people make that claim. The number of people who have NEVER had ANY security issue with Windows is simply amazing, if we are to believe all those claims.

Oddly, McCaffee, Symantec, and all the rest continue to make money hand over fist, and tens of thousands of computer shops in the US have steady, reliable incomes, thanks to the various security issues.

I can't possibly say whether this particular AC is full of shit or not, but whenever I hear such a claim, I can't help wondering.

A lot of people make that claim. The number of people who have NEVER had ANY security issue with Windows is simply amazing, if we are to believe all those claims.

Yes, and that's because for that lot of people it's probably true. I've never had this sort of problem with Windows either. The one time in my youth I first encountered "CoolWebSearch" it took me some time to discover it and how to fix it, and since then nothing.

Because Linux doesn't have the apps they want? They don't want to have to relearn years of knowledge built up using Windows? That it's not as simple to switch an entire OS and migrate all your programs and data as people like you would have people believe?

Depends on what "programs and data" you need. Now that most of my development is on web apps rather than standalone apps, it's pretty damn trivial for me to switch between OSes. I use a VM for the very occasional bout of Windows development I have to do, and Remote Desktop for server administration.

And your "years of knowledge built up using Windows"? Gimme a break. Those "years of knowledge" for most (but obviously not all) people amount to how to do a right click and where to find "My Documents". OSX and

I don't think we can get an estimate on that. Given The Oldest Profession, and given that I'm fairly certain that prostitutes still exist in some parts of the world, I'd say we've been happy to pay to be screwed for a very long time, with no data ever suggesting that we'd grow tired of it.